PAIA Manual

1. Introduction and contact details

This manual explains how to request access to records held by VerdanTech (Pty) Ltd under the Promotion of Access to Information Act 2 of 2000 (PAIA). It also describes how VerdanTech processes personal information, as section 51 of PAIA requires. VerdanTech is a private body: a digital marketing and technology services company.

2. Guide, automatic records and records kept under other laws

2.1 The Information Regulator’s PAIA Guide

The Information Regulator has published a Guide in every official language on how to use PAIA and POPIA, including the rights and remedies available. It is available free of charge from the Regulator’s PAIA resources page ( https://inforegulator.org.za/paia/) or on request from the Regulator:

2.2 Records available without a request

VerdanTech has not published a notice under section 52(2) of PAIA. The following are freely available on our website without a PAIA request: information about our services, our Website Terms of Use, our Privacy Policy and this manual.

2.3 Records kept under other legislation

VerdanTech keeps records as required by the following laws, where they apply to it:

1. Companies Act 71 of 2008
2. Income Tax Act 58 of 1962
3. Value-Added Tax Act 89 of 1991
4. Tax Administration Act 28 of 2011
5. Basic Conditions of Employment Act 75 of 1997
6. Labour Relations Act 66 of 1995
7. Employment Equity Act 55 of 1998
8. Unemployment Insurance Act 63 of 2001 and Unemployment Insurance Contributions Act 4 of 2002
9. Skills Development Levies Act 9 of 1999
10. Compensation for Occupational Injuries and Diseases Act 130 of 1993
11. Occupational Health and Safety Act 85 of 1993
12. Protection of Personal Information Act 4 of 2013
13. Consumer Protection Act 68 of 2008
14. Electronic Communications and Transactions Act 25 of 2002
15. Copyright Act 98 of 1978

A record kept under one of these laws is not automatically available to the public. Requests for it follow the procedure in section 4.

3. Records VerdanTech holds

VerdanTech holds records on the following subjects. Listing a category does not mean that access will be granted: each request is assessed under section 4.

4. How to request access

Under section 50 of PAIA, access to a record is granted if the record is required to exercise or protect a right, the request meets PAIA’s procedural requirements and no ground of refusal applies.

4.1 Making a request

1. Complete Form 2 (Request for Access to Record), available on the Regulator’s PAIA resources page ( https://inforegulator.org.za/paia/).
2. Email it to the Information Officer at info@verdantech.co.za or deliver it to our street address.
3. Identify the record, give your name and contact details, state the form of access you want and explain which right you need the record to exercise or protect.
4. If you request on behalf of someone else, include proof of your authority to act for them.

To access your own personal information, use the same procedure (section 23 of POPIA). To ask us to correct or delete your personal information, email the Information Officer or use a form substantially similar to Form 2 of the POPIA Regulations.

4.2 Timelines

1. We decide on a request within 30 days of receiving it and tell you the outcome in writing.
2. We may extend this once by up to 30 days in the circumstances PAIA allows, with written reasons.
3. If the request concerns a third party’s information, we notify the third party as sections 71 to 73 of PAIA require, which may extend the timeline.
4. If a record cannot be found or does not exist, we confirm this to you by affidavit.

4.3 Fees

These are the prescribed fees for private bodies under Annexure B of the PAIA Regulations, 2021 (Information Regulator fee structure: https://inforegulator.org.za/paia-fees-structure-2/). The request fee does not apply when you request your own personal information.

4.4 Grounds for refusal

We may or must refuse access on the grounds in sections 62 to 70 of PAIA, including where disclosure would:

1. unreasonably disclose personal information of a third party (section 63);
2. disclose a third party’s trade secrets, commercial information or confidential information (sections 64 and 65);
3. endanger the safety of individuals or property (section 66);
4. disclose records privileged from production in legal proceedings (section 67); or
5. disclose VerdanTech’s own trade secrets or commercial, financial or technical information that could cause it harm (section 68).

Section 70 requires disclosure in the public interest in limited circumstances, even where a ground of refusal applies.

4.5 Remedies

There is no internal appeal against a decision of a private body. If you are dissatisfied with our decision, you may lodge a complaint with the Information Regulator or apply to court, in each case within 180 days of the decision.

5. Processing of personal information

This section gives the information section 51(1)(c) of PAIA requires. Our Privacy Policy at https://www.verdan.tech/privacy-policy gives more detail.

5.1 Purposes

We process personal information to respond to enquiries, conclude and perform client agreements, run our Portal, website and tools, market our own services, manage employees and suppliers, keep records required by law and protect our legal rights. When we run services for clients, we process their customers’ information on their behalf as an operator.

5.2 Data subjects and categories of information

5.3 Recipients

Service providers that process information for us (including cloud hosting, email, productivity, CRM, project management, accounting, analytics, communication and artificial intelligence providers), professional advisers, auditors, insurers, debt collectors, credit bureaux and authorities where the law requires it.

5.4 Transfers outside South Africa

Some service providers store information outside South Africa, including in the European Union and the United States. We transfer personal information only as section 72 of POPIA permits, ordinarily where the recipient is subject to laws, binding corporate rules or an agreement that provide an adequate level of protection.

5.5 Security measures

We maintain appropriate, reasonable technical and organisational measures under section 19 of POPIA, including:

1. access restricted to authorised personnel on a need-to-know basis, with appropriate authentication;
2. encryption of personal information in transit;
3. reputable cloud service providers;
4. confidentiality obligations and data protection guidance for personnel; and
5. procedures for detecting and responding to security compromises.

6. Availability and updates

This manual is available on our website at https://www.verdan.tech/paia-manual and for inspection at our street address during office hours. A copy is free of charge on request. We review it at least once a year and whenever our records or processing change materially.